Delivering a Win/Win
for Fast & Secure Healthcare Information Access

Eric Kennedy, CLE, MCSE

erick@cdh.com

C/D/H

Paul Hilman, MCNE, PMP

paulh@cdh.com

C/D/H

Problem Statement

Doctors and nurses have 1,715 slow logins per day

Staff have multiple ID’s and passwords to access 6 key systems

Users don’t use many applications due to generic ID, re-login time, or passwords

Generic ID's violate HIPAA rules

600+ password related help desk calls per month

Project Goals

Initial Goals:

Reduce overall login times

Consolidate Users ID’s and Passwords

Elimination of Generic Login ID’s

Secondary Goals:

Reduce the Number of “Stop Points”

Allow Non-Stop Access to All Applications

Application “Book Mark” - Speed User Access to Patient Info

Speed the Logoff Process

Reduce Help Desk Calls

Why is this a Win/Win?

Doctors and Nurses support this initiative because it improves their ability to do work quickly

IT supports this initiative because it allows for a more secure environment and leads to less helpdesk support effort

Previous Login Process
-Phased Breakdown

Phase B -Desktop Load

Manual login of generic ID

Desktop Built

Printers assigned

Login Script Run

ZENworks® run

Policy deployed

Phase A -Boot

BIOS Post

Base OS load

Phase E

Manual login to PowerChart

Phase D

Manual selection of PowerChart app

Anonymous connection to Citrix farm

Phase C

Manual open of web browser

Application options displayed

Previous Login Process
-Phased Breakdown

Phase F

User able to begin doing work

New Login process
-Phased Breakdown

Phase 1

BIOS Post

Base OS load

Automatic login of security ID

Desktop Built

ZENworks run

Policy deployed

Novell Login screen displayed

Phase 2

Manual login by user ID

NSL runs and retrieves user credentials

Credentials used to automatically login to Citrix

Credentials used to automatically login to PowerChart

Other applications started and logged in as required

New Login Process
-Phased Breakdown

Phase 3

User able to do work

Login Timeline Comparison

A

B

C

D

E

F

Boot Up

Desktop Load

Nfuse

Citrix

PowerChart

40 sec

33 sec

3 sec

19 sec

4 sec

00:00:40

00:01:13

00:01:16

00:01:35

00:01:39

NetWare Client Auth Screen

Desktop Loaded

PowerChart Loaded

PowerChart Close

User Timeout

User Logout

User Resets Machine

1

2

3

Boot Up

PowerChart

45 sec

10-15 sec

00:00:45

User Login

PowerChart Loaded

User Logout

User Resets Machine

00:00:55

Suggestions for a Successful Project

Get out of the “ivory tower” and learn your users working habits and operating environment.

Collect “real” data to make “real” improvements

Set reasonable user expectations early

Look for other “wins” in business process improvement along with technical “wins”

Logging out almost as big as logging in

Novell Secure Login Quick Facts

Used to manage login to applications from the client side

Used to manage password changes

Operated by NSL scripts

Runs against eDir, AD, or LDAP 3 compliant directory

Application scripts can apply to Terminal, Win32 or Web applications

Many scripts are pre-made and more can be created

Secure Workstation Quick Facts

Installed with NSL client

Used to manage logout and login

Able to force-close applications

Able to disconnect Citrix connections

Supports proximity cards

Provides quick interface for logout

Configurable through eDirectory™ and NMAS

Active

Directory

Network Diagram and Process Flow

Windows XP Workstation

Citrix Farm

Citrix / Active Directory User Authentication

NSL Client on Citrix

PowerChart

User Authentication

Secure Application Credentials

Application Scripts

eDirectory Authentication

Workstation Authentication

Citrix Farm Authentication

Windows XP Workstation

MS Client

Novell Client

NSL Client

Citrix Client

Secure Workstation

eDirectory

Advantages of Solution

Reduce 6 Login ID/Password to 1

Reduce 4 “Stop Points” to 1

Eliminate Generic Login ID’s on the Patient Floors

Pre-launch Frequently Used Applications

Reduce Boot Up - 30 sec, Re-Login by 15 sec

Application Book Mark – Traveling Desktop

Simplified User Environment – Consistent Restart Point

Allow Non-Stop access to Users Applications

Location Specific Timeouts

Simplify & Speed Logoff Process

Help Desk call reduction

Major Factors in Reducing Login Time

Remove the Microsoft Client if possible

Use NSL in LDAP or client mode

Turn off milticast on the Novell Client

Run IP only

Remove Novell Client™ if possible

Use NSL in LDAP mode

Use ZENworks with middle tier services

Switch from NDPS to iPrint

Examine and trim all login scripts

Improve network infrastructure

Major Factors in Reducing Login Time

Reduce or modify use of ZENworks as authenticated user

Move as many applications to Citrix as possible

Improve Citrix hardware

Bring workstation hardware to reasonable minimums

Build new clean workstation images

Confirm every process in “RUN” registry and startup folders

Map entire process against packet trace

Implement in a wired configuration only

Leveraging NSL to Reduce Stop Points

Automate non-login processes

If all users choose a particular sub-application, NSL can automate that function

any repetitive process that requires user entry can be automated with an NSL script

Use start-up object to open frequently used applications

script can be written to allow users to pick applications to auto-start

Technical Security Notes

Secure Workstation idle timeouts should be used

Rights of automatic security user should be minimized

Consider pass-phrases

Consider two factor authentication

User “spoofing” prevented by NSL pass-phrase

NSL can support users being unaware of their application passwords

In this environment, complex passwords and frequent password changes are practical

Fast and Secure
Information Access Lab Installation Plan

Install and test one service at a time

Update the schema to support NSL

Install, configure and test NSL on the local workstation

Configure Secure Workstation for basic functionality

Install, configure and test NSL on the Citrix server

Integrate the local workstation and Citrix

Integrate the security user and Secure Workstation

Automate the security user login and application launch for all users

Lock down the rights of the security user

Perform total system testing and packet traces

Useful Links

NSL Documentation:

http://www.novell.com/documentation/securelogin3511/index.html

Secure Workstation:

http://support.novell.com/cgi-bin/search/searchtid.cgi?/10087273.htm

http://www.novell.com/coolsolutions/tools/1934.html

http://support.novell.com/cgi-bin/search/searchtid.cgi?/10087272.htm

TID on the [THIS] object:

http://support.novell.com/cgi-bin/search/searchtid.cgi?/10087020.htm

TID on SDIDiag:

http://support.novell.com/cgi-bin/search/searchtid.cgi?/10088626.htm

Useful Links

Dependency Walker for configuring terminal applications

http://www.dependencywalker.com/

TID on clearing a user’s passphrase

http://support.novell.com/cgi-bin/search/searchtid.cgi?/10086375.htm

Q & A

Delivering a Win/Win Solution

Users win with reduced sign-on, combined passwords

Users win with faster login times, non-stop access

Users win with “application bookmark” to access patient information quickly while roaming

IT wins with removing Generic User ID's

IT wins with Policy Driven Log Out Services

IT wins with tougher password policy

IT wins with fewer help desk password reset calls

EVERYONE gets a Win/Win Solution!

TUT 275

2003-12-08T12:43:39